http2smugl

http2smugl このツールは、フロントエンドサーバーによるHTTP/2 - HTTP/1.1変換を介してHTTPリクエストスマグリングが達成可能なケースを検出し、悪用するのに役立ちます。 仕組みは以下の通りです： 1. 攻撃者は細工されたHTTP/2リクエストをターゲットサーバー（これを フロントエンド と呼びます）に送信します。 2. そのリクエストは（おそらく）HTTP/1.1に変換され、別の バックエンド サーバーに転送されます。 攻撃者は、バックエンドサーバーによって2つの別々のリクエストとして認識されるようなリクエストを見つけたいと考えています。...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-49097

camel-irc irc.sendTo 头部注入复现工具 CVE-2026-49097 该项目演示了 Apache Camel 的 camel-irc 组件中的一个消息头注入 漏洞，追踪编号为 CVE-2026-49097 。IrcProducer 读取 irc.sendTo 头部以选择出站 IRC 消息的目标；当该头部存在时，会覆盖端点配置的频道列表 ： root@kitploit: // IrcProducer.process 受影响版本 4.18.2 final String sendTo =...

CVE-2026-49098

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC 标头注入 针对同一 Apache Camel 漏洞的可运行概念验证复现程序，每个运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（捆绑 Camel 4.20.0 ） 两者均为受...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2026-48206

CVE-2026-48206 — camel-jira IssueKey Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

CVE-2026-55994

camel-iggy User-Header Injection Reproducer CVE-2026-55994 This project demonstrates a message-header injection in Apache Camel's camel-iggy component, tracked as CVE-2026-55994. The Iggy consumer copies an inbound message's user-headers onto the Camel Exchange without anyHeaderFilterStrategy, so...

CVE-2017-5638

CVE-2017-5638 该脚本用于验证 Apache Struts 2 漏洞（CVE-2017-5638），又称 Struts-Shock。它完全无害，不会注入任何恶意负载，仅注入一个名为 'STRUTS2-VALIDATION' 的 HTTP 头，以便验证是否存在漏洞。 由于其多线程能力，它能够在不到10分钟内运行全球范围内的2500多个应用程序。因此，它对于大规模验证企业应用程序非常方便。 用法 运行此脚本有两种方式：带线程和不带线程，唯一的区别在于执行时间。要启用线程功能，只需传递线程参数即可。 第一个参数必须是一个包含所有目标 URL 的 TXT 文件，每行一个。请注意，这些...

Next.Js-middleware-bypass-vulnerability-CVE-2025-29927

A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts. Details: Read Here This uses Next.js version 15.2.2. The vulnerability allows the user to bypass the middleware script which contains the verification and can access the admin page without...

next.js_cve-2025-29927

next.jscve-2025-29927 A small and simple Next.js application running version 14.2.24 used to test CVE-2025-29927. Access the admin area /admin by utilizing the vulnerability or the hardcoded credentials admin:admin. root@kitploit: » git clone...

NextJS_CVE-2025-29927

Next.js Authorization Bypass Demo This application demonstrates the x-middleware-subrequest vulnerability in Next.js 13.4.19, which allows bypassing middleware protection. Setup 1. Install dependencies: root@kitploit: npm install 2. Start the development server: root@kitploit: npm run dev...

nextjs-cve-2025-29927

Next.js CVE-2025-29927 Middleware Vulnerability This repository is a monorepo project that allows you to compare the CVE-2025-29927 middleware vulnerability between Next.js versions 15.2.3 and 15.1.7. Vulnerability Description CVE-2025-29927 is a security vulnerability discovered in Next.js...

next-attack

This is a Next.js project bootstrapped with create-next-app. Testing the vulnerability First, you can confirm that the middleware works and should redirect the user: root@kitploit: curl http://localhost:3000/api/admin Then, you can show how the middleware is being bypassed with the followign...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-81179

SysReptor is a pentest reporting platform vulnerable to Host header injection prior to version 2026.58 . When password reset by email is enabled and ALLOWED_HOSTS is configured with a wildcard, an unauthenticated attacker can request a reset email whose link points to an attacker-controlled syste...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...